localize

Description

Returns a list of time ranges in which the search results are found.

Generates result representing a list of time contiguous event regions. This is defined as a period of time in which consecutive events are separated by, at most, 'maxpause' time. The regions found can be expanded using the 'timeafter' and 'timebefore' modifiers to expand the range after/before the last/first event in the region, respectively. These expansions are done arbitrarily, possibly causing overlaps in the regions if the values are larger than 'maxpause'. The regions are returned in search order, or descending time for historical searches and data-arrival order for realtime search. The time of each region is the initial pre-expanded start-time. The regions discovered by the localize command are meant to be fed into the map command, which will use a different region for each iteration. The localize command also reports: (a) number of events in the range, (b) range duration in seconds and (c) region density defined as (#of events in range) divided by (range duration) - events per second.

Syntax

localize [<maxpause>] [<timeafter>] [<timebefore>]

Optional arguments

maxpause

Syntax: maxpause=<int>(s|m|h|d)

Description: Specify the maximum (inclusive) time between two consecutive events in a contiguous time region.

Default: 1m

timeafter

Syntax: timeafter=<int>(s|m|h|d)

Description: Specify the amount of time to add to the output endtime field (expand the time region forward in time).

Default: 30s

timebefore

Syntax: timebefore=<int>(s|m|h|d)

Description: Specify the amount of time to subtract from the output starttime field (expand the time region backwards in time).

Default: 30s

Usage

Descending time order required

The transaction command requires that the incoming events be in descending time order. Some commands, such as eval, do not output search results in time order. If one of these commands precedes the transaction command, your search returns an error.

To ensure that the search results are in descending order, you must include the sort command immediately before the transaction command in your search.

Examples

1. Search the time range of each previous result for the term "failure"

2: Finds suitable regions around where "error" occurs

Searching for "error" and calling the localize command finds suitable regions around where error occurs and passes each on to the search inside of the map command. Each iteration works with a specific time range to find potential transactions.

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

Feedback submitted, thanks!

You must be logged into splunk.com in order to post comments.
Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic.
If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk,
consider posting a question to Splunkbase Answers.

0
out of 1000 Characters

Your Comment Has Been Posted Above

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website.
Learn more (including how to update your settings) here »